IV. Sniffing Passwords Using Wireshark

Scenario

As in the previous lab, you are able to capture TCP and UDP conversations; an attacker, too, can collect this information and perform attacks on a network. Attackers listen to the conversation occurring between two hosts and issue packets using the same source IP address. Attackers will first know the IP address and correct sequence number by monitoring the traffic. Once the attacker has control over the connection, he or she then sends counterfeit packets. These sorts of attacks can cause various types of damage, including the injection into an existing TCP connection of data and the premature closure of an existing TCP connection by the injection of counterfeit packets with the FIN bit set.

As an administrator, you can configure a firewall or router to prevent the damage caused by such attacks. To be an expert ethical hacker and penetration tester, you must have sound knowledge of sniffing network packets, performing ARP poisoning, spoofing the network, and DNS poisoning. Another use of a packet analyzer is to sniff passwords, which you will learn about in this lab using the Wireshark packet analyzer.

Lab Objectives

The objective of this lab is to demonstrate the sniffing technique to capture from multiple interfaces and data collection from any network topology.

Lab Analysis

In this lab, you have learnt how to sniff to capture from multiple interfaces and data collection from any network topology. Analyze and document the results related to the lab exercise. Give your opinion on your target’s security posture and “exposure” through public and free information.